Apache released version 2.4.71 of its HTTP Server on November 11, 2026. It closes a vulnerability classified as critical in the mod_http2 module (CVE-2026-119618), through which, according to the security vendor Wiz, an attacker can execute foreign code on the server remotely and without authentication.
Versions 2.4.55 through 2.4.70 are affected. On the day of publication, Wiz knew of neither a public exploit nor any attacks. This status can change quickly once details about the flaw are circulating.
What is behind the vulnerability in mod_http2?
The flaw lies in the assign_headers() function. There, several parts of the program access the same data at the same time without coordinating properly. With unfavorable timing, the heap (the memory area for dynamic data) is corrupted, and if successful, foreign code runs with the privileges of the web server process.
The security reports from Apache list the flaw as critical. It was found by Anthropic's OSS Scanner, which reported it on October 26, and independently by researchers from Google Cloud on November 3. The fix was created on November 11, and 2.4.71 was released the same day.
The update brings two further corrections. In mod_md, a child process crashes on certain requests (level "important", versions 2.4.30 through 2.4.70). In mod_vhost_alias, a bug overwrites a single byte on the stack (level "low", only 2.4.69 and 2.4.70).
Does this also affect your WordPress site?
The vulnerability sits in the web server, not in WordPress. It affects every site served by an Apache with mod_http2 in the versions mentioned, and therefore also many WordPress installations. Other web servers such as nginx are not mentioned in the report.
How widespread this is, Wiz quantifies for cloud environments: 64 percent of the examined environments contain affected resources, 51 percent publicly accessible instances. Wiz did not take the configuration into account, so whether HTTP/2 is active remains open. For mod_h2 from a separate GitHub source, you check the version yourself: Apache lists 2.0.8 through 2.0.42 as affected, Wiz names 2.0.42 as the patched version.
What this means for you
On your own server or vServer, you read out the version with apachectl -v and check with apachectl -M whether the http2_module module is loaded. If the version is between 2.4.55 and 2.4.70, install the update to 2.4.71. Linux distributions often adopt fixes without a new version number; in that case, the package's changelog shows whether the vulnerability has been fixed.
What do you do about the mod_http2 vulnerability?
For Apache 2.4.55 through 2.4.70, as of November 11, 2026
How do you run your website?
- Own server or vServerUpdate to Apache 2.4.71
- Hosting packageAsk the host about the patch status
- Update not possible immediatelyDisable HTTP/2, allow only http/1.1
At the time of the Wiz analysis, no exploit was known.
Sources: Apache HTTP Server Project, Wiz
An immediate update is not always possible. In that case, a interim solution helps: in the configuration, only http/1.1 remains under Protocols, and the entries h2 and h2c are removed. Browsers then fall back to HTTP/1.1, your site remains reachable and possibly loads somewhat more slowly until the update.
With a hosting package, you cannot update the server yourself. It is best to ask the host whether 2.4.71 or a package with the fix is in use, and note down the date and the answer in case you look after client sites.
Apache released version 2.4.71 on November 11, 2026.
Sources
